When Adverse Media Causes KYC and Banking Problems: Legal Remedies for High-Net-Worth Individuals

When Adverse Media Causes KYC and Banking Problems: Legal Remedies for High-Net-Worth Individuals

In an increasingly interconnected world, high-net-worth individuals often live in multiple locations, hold assets and property in multiple jurisdictions, and maintain banking and investment relationships internationally.  As a result, due diligence and know your customer (KYC) checks are increasingly informed by the results of global media screening.

Adverse media is commonly incorporated into risk intelligence databases used by banks, financial institutions and other regulated organisations.  This can create significant challenges for onboarding and approval processes where articles contain inaccurate, misleading or out of date information.  In some extreme cases, adverse media is deliberately disseminated by bad actors seeking to destabilise and disrupt an individual.

The consequences can be severe.  An individual’s ability to open bank accounts, maintain investment relationships or satisfy regulatory due diligence requirements may be adversely affected.

Identifying, removing or contextualising defamatory, outdated or inaccurate reporting has become critical to resolve existing compliance and KYC concerns.  Effective management of adverse media can help protect an individual’s reputation while preserving access to essential financial, commercial and business opportunities.

Understanding the problem

Often the first indication that there is an issue with a particular article, or adverse media more generally, is when an organisation refuses to onboard an individual or a bank refuses to undertake financial transactions.  In many cases, an organisation may not be prepared to fully explain the problem is caused by adverse media and this can leave an individual unable to understand and therefore solve it.

A first step may therefore be to identify what articles are impacting on compliance issues by exercising a ‘right of access’ and making a Data Subject Access Request pursuant to Article 15 of the UK General Data Protection Regulation (UK GDPR).

Surject to certain exemptions, that request requires an organisation to provide copies of the personal data it is processing and this should reveal articles that have been collated or relied upon in forming a negative assessment.

Once those articles have been received, an individual is in a much stronger position to assess the nature of the problem and the possible solution.

Steps to resolve the problem

Defamation

The law of defamation is designed to protect an individual from unlawful harm to their reputation.  In order to have a prima facie claim, a claimant must show that a statement was published to a third party, which referred to the claimant, would tend to lower their reputation in the eyes of right-thinking members of society, and has caused or is likely to cause serious harm to their reputation.

There are various defences to a defamation claim and issues around jurisdiction and timings for bringing a claim.  However, often litigation is unnecessary and defamatory allegations are corrected once they have been notified to the publisher without the need for legal proceedings.

Even if it is not possible or advisable to take steps against the original publisher of an article every publication or republication of a defamatory statement is a new publication and each publisher is liable as if the defamatory statement had originated with them.  Therefore, and depending on the precise circumstances, the operator of a risk intelligence database may well also be liable in defamation for repeating the allegations contained in an article and therefore agree to remove reference to it from the risk intelligence database.

Data protection

Articles 16 and 17 of the UK GDPR provide a ‘right to rectification’ and ‘right to erasure’ where processing of a person’s data is inaccurate, outdated or no longer necessary.  The ‘right to erasure’ is commonly known as the ‘right to be forgotten’.

These rights are not absolute and there can be defences for media organisations processing data for journalistic purposes.  However, these defences do not apply to search engines such as Google and it is therefore possible to de-link articles from searches conducted against an individual’s name in this jurisdiction.  A request may be refused where continued processing is justified in the public interest or to ensure freedom of expression.  Where a request succeeds, articles may no longer appear on an individual’s profile depending on the jurisdiction of the risk intelligence database.

Summary

Adverse media reporting identified by risk intelligence databases can cause significant issues for individuals.  Timely use of defamation and data protection remedies can help to unlock compliance issues and reduce the risk of future disruption to an individual’s financial affairs and business activities or harm to their reputation.

Where compliance concerns arise from information recorded on risk intelligence databases such as World-Check, recent cases have shown that legal rights may exist against the database operator itself